Throughout your career.
As a cybersecurity specialist,
you're going to come in contact with a
lot of different regulations and compliance reports,
even contractual obligations that you need to be aware of.
In this episode,
we're going to discuss the different frameworks that you
need to be aware of and specifically for cy
the depth of which you need to be aware of these different frameworks.
The different industry frameworks that you need to be
familiar with are listed here on this slide.
What you need to remember about those different industry frameworks is how they
come into play with your job or your role as a cybersecurity analyst.
You don't need to go into such depth with these different
security frameworks to where you know them inside and out.
However, your job,
as you're moving forward as an analyst may require you to go into
more depth than what you're going to see here in our presentation today
for CYS A.
What you really need to understand is the different
aspects of each different framework and how they are
different from one another as opposed to the same
as one another within the different frameworks that were
you today it's important to note that you don't have
to know each and every one as a detailed level.
The exam isn't specifically over one frame framework over another.
It's more or less a ideology that you need to be familiar with
and a high level overview,
meaning you may get a question on what type
of framework is more for an international standard organization
versus one that is specifically for the United States. You may also
get different questions on related to the availability
of the data specific to a specific framework.
We'll go into each one of these frameworks moving forward to kind of give you a clue.
And then we'll wrap out at the end of the
episode to identify what kind of questions you might see.
The first framework I want to talk about that isn't
actually in CYS A is the nist cybersecurity framework.
This framework is all about understanding
the specific standards and technologies specific to
cybersecurity in the United States.
Now, this framework is specific to security plus, but it's not technically in the
cysa objectives. So why do we bring this up for you to understand?
Well, it's quite simple if it's in security plus,
you probably need to know it because it's probably
going to be added in later revisions for CYSA.
With that said,
you have to remember that this cybersecurity framework is all
about United States standards and how that technology is used in
cybersecurity.
This framework is all about understanding those specific industry,
technology requirements,
ie what does a firewall do and how does that firewall supposed to
be properly configured in order to maintain
the best reliability within your network?
Nist is all about understanding specific fundamentals
of what the technology should do.
And it's more technology centric rather than policy or procedure basics.
It doesn't mean that it doesn't have policies or procedures really in there.
It does but not at an indepth level.
It's really more about the technology and how that
technology should be utilized within each individual network.
The payment card industry,
data security standard or PCI DS S is specific to cardholders.
If you get exam questions specific to hardware
data or financial information related back to a security standard,
you have to remember that pcidss is most likely what
they're referring to this standard is all about protecting cardholder
data and to maintain secure payment systems throughout not only
the technology process but also the procedures tasked with individuals.
The pcidss framework is designed specifically for payment
card industry but it's not a regulation,
it's not a government entity that's coming in and in
saying this contractual obligation, this is where
the industry really took hold and said we need to come up with our
own standards of the federal government doesn't come in and mess everything up.
That's exactly what the PCI Ds S is all about.
It's a contractual obligation between the users of those
credit cards and how those credit card information is processed
versus the actual cardholder security systems
at the
higher rent.
It enables such things as saying, hey, you need to have encryption.
When you're sending payment card information over the wire,
you need to store your information in this form or fashion.
You'll see that I'm not really identifying
specifics within the payment card industry,
but more of a high level overview.
And those are the types of questions that you should
expect to see when it comes to PCI Ds S in
relation to your cys A exam.
This payment card industry data security standard is all
about understanding the risk and the liability to the cardholder
and the processes that are in place ie the financial institution
and to minimize that liability and risk as much as possible.
If you see exam questions like this security standard
uh is how you would facilitate encryption over credit
card or over the transmission of cardholder data.
That's usually going to be PCI Ds S when it comes to those exam questions,
the center of internet security CI S benchmarks was originally the SANS top 20.
They over the years have migrated over to this new form of functionality,
which we specifically talk about today.
Again, you don't need to know the specifics of the CI S benchmarks,
but you do need to understand what they're there for.
The actions are designed to help enhance
your overall security posture within the organization.
We're going to discuss both of those right now.
And I'm going to show you what we're talking about.
Let's talk about the N cybersecurity framework.
And I'm gonna show you what that website looks like right now.
This is the n.gov
cyber framework website,
which you can access via the link that we provide you in the resources page.
You can see here on the website that we've got different resources
available to us and that we're currently in the Cybersecurity framework 2.0.
You can read the document just by hitting this little tab right here.
You can set up different templates or profiles associated with
how you would utilize this framework within your own organization.
You can see a different quick start guide specific tier and of course,
there's the mapping which really provides you a resource to identify.
I've got this issue and I want to map it
to this policy or procedure that NIST has put out.
If I click on the read document,
you can see here that it's going to have a little pop up menu.
I'm just going to press OK,
on understanding that I understand my rights and privileges
and it pulls up the document.
This document is fantastic for providing you a basic abstract and understand
of what this information covers.
Again,
the table of time can come to play and you can see that this
is a very hefty document and recently updated as of February 26 2024.
You can scroll down and utilize different accesses for this document.
For instance, let's say I wanted to improve my risk management communication.
It talks about how you can improve
those risk management communications within your own organization
and provide some handy, handy guide that come along with it.
Again,
this is really overall a good foundational level
for the cybersecurity frameworks that you might utilize.
And if you scroll down a little bit more,
you can start to see where it comes into play with privacy,
risk versus cybersecurity risk.
And it really does provide that cohesive knowledge base
that you may see in the United States.
Now, I did talk about a little bit of how N
comes into play with understanding the technical terms within the framework.
You can see here that if I scroll all the way down,
if you scroll down to Appendix B,
you can see here that we have different tiers associated with risk governance.
This document provides us the different risk governance associated with it
and how to utilize that risk governance in our own different organization.
Again,
you can see tier one, tier two, tier three and it goes down all the way to tier four,
which we see adaptable,
meaning that your organization is adaptive to what's going on.
This specific document is only 27 pages long.
So it provides a good understanding of the overall
framework of how to utilize the cybersecurity framework,
but it's not going to go into so much
detail that it overrides your process or your thinking.
Again, it's a good resource to have.
We're going to take a look at the CI S benchmarks and how that web
page looks as well so that you can get a handle on what it encompasses.
When you first log into the CI S or the center of internet security website,
you'll have to log in with your email and
provide that information to sign up for the website.
Once you've signed up,
you should see a web page that looks something similar to here.
You can see that it provides the different benchmarks that need
to be associated with the different technology that may use.
For instance, operating systems.
You can see here, there's distribution for independent Linux.
We can scroll down and you see that it's got Windows,
10 windows 11 and the different editions.
You can even see that it provides those Microsoft
Windows seven workstation benchmarks from way way long ago.
If you continue to scroll down, you can see Debian
B
and B
two. We can also see Amazon S
OS
and you can see the full gambit of different operating
systems that are out there and available today where CI S
has come in and said this is how we're going to
secure these different operating systems
through the different benchmarks available.
There's just a ton of them available here including VM ware MongoDB.
There's also a patchy tomcat.
I mean,
it's just an incredible amount of information available at your fingertips,
each associated to a different operating system or provider
associated with the different technology you may utilize while
it doesn't have 100% of every technology available.
You can see that it covers even some of the more minute details like snowflake.
It even provides mobile devices such as Apple and Google Android.
And further goes down the Jupiter.
We see Google Chrome, I mean there's just a phenomenal amount of them out here.
We're going to click on the distribution for
independent Linux here and download the PDF.
This is the CI S benchmark for
the distribution of independent Linux systems version 2.00
you can see here that it was updated in 716 of 2019
and it provides a quick terms of use. I can go through this and identify
the different aspects of the system that I want to know more about.
For instance, if I wanted to know more about mounting of
MF
file systems and is disabled, it's on page 21.
If I want to go through and ensure that the separate partition exists for V
and log scored, I can go 53.
Let's scroll down to one and just at random and try to see what it looks like.
So this one right here
is literally ensuring that your node V option
is set to TNP partition and it's scored.
We can see here that it's considered a profile
applicability for a server and workstation level one.
And it's on the node B mount.
If I scroll down to the bottom,
you can see that we can verify the node B option
is set if the T MP partition exists by providing a mount
with grab E. And then I guess the entire command, the best part is I can literally
grab all of that
copy it and then put it into my Linux system. If I wanted to, to run that command,
it provides us a great foundation for
understanding the different positions and how to secure
our operating systems and it provides the commands in order to make it happen.
CI S has gone through a lot of detail to provide this information to you as a user.
But as far as CYS A is concerned,
while you don't necessarily need to know each individual command or
even understand the overall complexities of how to do it,
you do need to know where the references are and how to utilize them.
That's really where the co ISA comes into play.
It's that high level overview of understanding.
If I want to understand on an independent workstation,
where would I get those specific commands from?
The answer would obviously be the CI S benchmarks for an independent Linux system.
Now again, it provides us a load of different manuals to go through.
You don't need to memorize all those just realize that
that's where the CI S benchmarks really come into play.
The other resource that I really want to show
you is a guide for defining reasonable cybersecurity.
This was again put out by CI s and let's take a look at that right now.
So in the reference material and the resources below,
we've provided you this guide that you can download to your own machine.
This guide is a simple PDF and it
provides us a guide for defining reasonable cybersecurity.
Again,
it provides us a basic Acknowledgments page and then it provides us the executive
summary which basically says there's no minimum
standard available across the United States.
We don't have any laws or regulations that dictate across our industry.
Exactly how we have to go through
the different processes and procedures to secure.
There's no set standard if IBM wants to do it
their way and Microsoft wants to do it their way.
There's nothing in there as far as the law is concerned
in forcing those companies to meet those minimum standards available.
That's where the reasonable cybersecurity guide really comes into play.
The latest edition was put out in May 1st of 2024.
So it's somewhat recent and provides us a lot of great information.
If you scroll down, you can see here that we have a timeline of federal security laws.
So it gives us a little bit of a foundation of where we came from,
what laws are available and how they intersect with cybersecurity.
But if we skip down to the very bottom on page 14,
we can see how an organization should properly
implement cyber safeguards to achieve reasonable cybersecurity.
In section five,
we can see how an organization should
properly implement cybersecurity safeguards to achieve reasonable
Cybersecurity.
This guide doesn't go into the specifics on exactly what needs to happen.
But it does provide us in a high level overview of your different environments.
For instance, it says you should know your environment,
we need to account and configuration management, we need security tools,
data recovery, security awareness, and of course,
business processes and outsourcing.
And it provides some great guides and high level knowledge of
what they constitute as a reasonable safeguard within the system.
It provides us a blanket statement over what
they consider to be security awareness and,
and all that should be utilized within your organization.
Again, it's not providing any specific details,
but it is providing us a great overview of what you should be doing
from a specific procedure or process point of view.
If we scroll down even more,
you can see the data privacy statutes available on a state by state basis.
And again, if I keep scrolling down,
it goes into more and more detail as we go through.
Finally, on appendix, H you can see implementing all 153 safeguards for the cis
critical security controls and it provides again, you should be taking,
but it doesn't exactly tell you how to take those action.
For instance,
number two says we need to actively manage our inventory track
and correct all software operating systems and applications on networks.
So that only authorized software is installed and can execute and that
unauthorized and unmanaged software is found
and prevented from installation or execution.
It just tells us to do it, it doesn't tell us how to do it.
And that's really where the blunt of the information comes in from a high level.
For the cys A exam.
You really just need to understand that this document exists
and that it provides us a reasonable guide for cybersecurity.
That guide is very high level and provides us a list of things
that we should do within our own organizations to better protect and safeguard,
not only our data
but consumer data that may be residing on our systems.
The ISO or International Organization of standardization
produced the 27,000 series specific to cybersecurity.
The 27,000 really lists the overall
objectives or vocabulary specific to cybersecurity
and it really doesn't go into finite decisions that need to be made.
But it provides an overall arch of the different
different episodes or different guides available to it.
For instance,
ISO 27,001 goes over information
security management systems and the requirements
as seen by ISO it's a standardization that they say,
hey,
we need to do this in order to meet the
guidelines or requirements set for by ISO 27,000 series.
Now each one of these little different
guides specific to a specific industry requirement.
Meaning while it all has to do with Cybersecurity or security in general,
the different guides associated with it come
at different concepts associated with that security.
For instance,
29,005 goes over security risk management and
27,006 goes over requirements for bodies proving
audit and certification.
While this guide or while this organization standardization can be certified,
you can go through the actual
checks and balances and audits to be ISO certified for 27,000.
It's not necessarily a requirement based on every organization that you want.
A
lot of organizations in the United States.
They go more towards the n
side of the house but not all of them.
Some organizations use one or the other
and some organizations use both because NIST is
more on the technical perspective and ISO is
more on the process and procedures perspective.
What you need to know about this as far as CI S A is concerned
is that a lot of questions that you're going to see come in
the fact of which standards organization is
international or which one is worldwide.
They really ask those questions,
providing the different numbers or nomenclatures associated with it with ISO,
you should expect to see questions like which of
these ISO standards it deals with specific to information,
security management.
That's 27,001.
You don't really need to know every last one of these
different episodes or guides or remediations when it comes into play.
But I would have an idea of that.
27,001 is the most popular followed by 27,005, which is risk management.
The other ones you just need to realize are there and you should be ok for the exam.
For the most part,
I wouldn't expect to see questions that relate directly to what the guides hold.
But more of a high level overview of knowing where to find the information.
If you need it to address the guide.
For instance,
you may be asked a question on which guide
within the 27,000 series specifically deals with risk management.
You might need to know that that is ISO 27,005.
Let's take a look at the 27,000 series and what it looks like on the webpage. Now,
if you go straight to the ISO standards and look at IEC 27,000 family,
you can scroll down and actually get the email updates.
You don't necessarily need to subscribe to it, but just be aware that you can
underneath, you can see the different highlights associated with the 27,000.
And you can see the different dates associated with each manual.
For instance, the Information Technology 27,000 series,
the overall 27000 manual was produced in 2018.
That is the latest copy. You can see that 27,001 was
updated in 2022 same with 2002.
Now, unfortunately, these are blocked behind a paywall.
However,
if your organization or your infrastructure deals specifically
with ISO as one of their components,
these would be unlocked for you and you would
have full access to each one of these manuals.
Again, cys A doesn't expect you to know exactly what's in each one.
Just know where to find the information. If you're asked a question about it.
If we open up the 27,001 right here,
you can see on this document that it provides
us a basic understanding of what 27,000 includes.
We can see on the right hand side, it provides us a scope,
the references and the specific information of what's going
to be covered within each one of the documents.
If I scroll down, it provides me the purpose of the document,
the scope access.
And we can see here that some of the information is
notably missing based on the fact that it's behind a paywall.
If I scroll all the way down,
we can see information, security, incident management.
And it says to direct yourself to 3.54 for detecting reporting, assessing,
responding, dealing with and learning from information security incidents.
If I scroll down some more,
we can see that it just provides us a different
list of the different confines associated with the 27,000 series.
It's literally just telling you where to find
the information if you're looking specifically for something
in the 27,000 manual.
Next, I want to talk about the Os
top 10 or the open worldwide application security project top 10.
When it comes to web application vulnerabilities.
This website provides us some good information when
it concerns specific to web application security.
Let's take a look at their website right now and see what it has to tell us
here. You can see the
top 10 project associated with web application vulnerabilities.
This is a standardized awareness document
for developers and web application security
and it was recently updated in 2021.
They update this website about every 3 to 4
years depending on what's going on within the industry.
You can see here that they provided us the 2017 and transposed it over into 2021
while some of this has changed, most of it has not.
We're only seeing three new designs or
vulnerabilities associated with their newest version.
For instance, in
A 04, we can see insecure design
that insecure design is new. Compared to 2017.
You don't need to know as far as CYS A is concerned the 2017 vulnerabilities,
you only need to know the 2021 vulnerabilities,
but it would be a good idea to understand and appreciate
each one of the different vulnerabilities they've associated with this.
And that's why I provided that cross reference in order for you to,
to cross reference what you're trying to look at.
For instance, broken access control.
This one provides us that 94% of applications were
tested for some sort of broken access control.
You don't necessarily need to know that 94% of applications were tested.
You just need to know that what broken access control is part of the
OS top 10.
You can expect to see questions related to which
one of these security vulnerabilities is associated with,
which
was
top 10.
It's not uncommon to see different questions associated with CO
ISA which true back to the different vulnerabilities listed in the
OS top 10.
You might see a question like which one of these relate back to an
OS top 10 vulnerability and it might be insecure design where it
relates this type of design or the scenario proceeds back into this O
A
top 10.
You might see a question that relates back
to the security design or security vulnerabilities within an
OS top 10,
something like which one of these security
misconfigurations relate back to top 10 vulnerability.
You might see a question like uh
username and passwords are set for default or
something else triggering where we're not using a capsa,
something like that might relate back to a security misconfiguration.
Obviously, a capsa
is not a security misconfiguration but default username and password is this
is where you might see different questions related specifically to top 10.
And
Owasp be aware that you need to memorize each one of these
top tens when it comes into play and specifically to the 2021
version, not the 2017 version.
If you can identify that you should be go for most of the example
within this episode,
we talked about the frameworks that you need to be familiar with.
As you approach the CYS A exam within your own careers,
you should be associated and known for each one of these
different frameworks and how they're
introduced within your separate organizations.
For instance, if you're looking for a career, say in the payment card industry,
it would be expected that you know,
more than just the high level overview of the PCI Ds S framework
on the same version. It's just like working in health care.
If you are working in a health care environment, even as an it perspective,
you need to know more about HPA than say somebody that's
working in telecommunications as far as CYS A is concerned.
It's a very broad overview of each one of the
different standardizations that would come into play for regulatory reliance.
Meaning you only really need to know that
PCI DS S has to deal with financial institutions
and payment card industry and that data should be encrypted from point A to point C.
That's where we're going with this,
you don't need to dive into each one of the individual
frameworks because the exam isn't decided upon an individual framework.
It's a high level overview,
do not go into each one of these frameworks into a deep level,
trying to figure out what each framework really encompasses.
It's not going to be on the exam.
You really just have to have a high level overview of
what it includes and a memorization of the OS top 10.
And you should be good for most of the exam questions that come into play.